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REAL PARTY IN INTEREST 

The real party in interest is Hewlett-Packard Development Company, LP having a 
principle place of business at 20555 S.H. 249 Houston, TX 77070, U.S.A. (hereinafter 
"HPDC"). HPDC is a Texas limited partnership and is a wholly-owned affiliate of Hewlett- 
Packard Company, a Delaware corporation, headquartered in Palo Alto, CA. The general or 
managing partner of HPDC is HPQ Holdings, LLC. 

RELATED APPEALS AND INTERFERENCES 

There are no other prior and pending appeals, interferences or judicial proceedings 
that may be related to, directly affected by or having a bearing on the Board's decision in this 
Appeal. 

STATUS OF CLAIMS 

Claims 1-47 were rejected in a Final Office Action mailed June 30, 2005. Claims 1- 
47 are pending in the application and are subject of the present Appeal. 

STATUS OF AMENDMENTS 

No Amendments to the claims have been filed subsequent to the Final Office Action 
mailed June 30, 2005. 

SUMMARY OF THE CLAIMED SUBJECT MATTER 

The summary is set forth as an exemplary embodiment as the language corresponding 
to independent claims 1, 13, 23, 29, 37, 45, and 46. Discussions about elements of claims 1, 
13, 23, 29, 37, 45, and 46 can be found at least at the cited locations in the specification and 
drawings. 

One aspect of the present invention, as claimed in independent claim 1, provides a 
method for analyzing a stream of network usage data (25) comprising generating a statistical 
model (34) from a set of usage data record events (25). See Specification at page 14, line 18 
through page 15, line 10; and Figure L The method includes receiving a most recent record 
event (52) and updating the statistical model (34) using the most recent record event (52) by 
adding the most recent record event (52) to the statistical model (34). An identifier is 
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associated with each record event (25). The method includes updating only a portion of the 
statistical model (34) associated with the identifier. See specification at page 10, line 27 
through page 11, line 12; page 14, line 18 through page 15, line 10; and Figures 1, 2, 7 and 8. 

Another aspect of the present invention, as claimed in independent claim 13, provides 
a method for analyzing a stream of network usage data (25) over a rolling time interval. The 
method includes defining a statistical model (34) for analyzing the stream of network usage 
data (25) over the rolling time interval, defining the rolling time interval to include a plurality 
of update time intervals (210); and receiving a record event from the stream of data for each 
update time interval (210). The method includes storing the record event for each update 
interval (210) in a history cache (24), generating the statistical model (34) over the rolling 
time interval using the statistical model (34) and each record event stored in the history cache 
(24), and updating the statistical model (34) using the statistical model (34) and a most recent 
record event (218) for a most recent update time interval (220), including updating only a 
portion of the statistical model (34) associated with the most recent record event (218). See 
specification at page 10, line 27 through page 11, line 12; page 14, line 18 through page 17, 
line 2; and Figures 1, 7, 8, and 9. 

Yet another aspect of the present invention as claimed in independent claim 23, 
provides a method for analyzing a stream of network usage data (25) over a rolling time 
interval. The method includes defining a statistical model (34) for analyzing the stream of 
network usage data (25) over the rolling time interval, defining the rolling time interval to 
include a plurality of update time intervals (210), and receiving a record event set from the 
stream of data for each update time interval (210). Each record event set (70) includes one or 
more record events (72, 74, 76). Each record event (72, 74, 76) is associated with a user 
identifier. The method includes storing the record event set (70) for each update interval in a 
history cache (24), generating the statistical model (34) over the rolling time interval using 
each record event (72, 74, 76) stored in the history cache (24), and updating only a portion of 
the statistical model (34) associated with the most recent record event (218) for a most recent 
update time interval (220). See specification at page 10, line 27 through page 11, line 12; 
page 14, line 18 through page 17, line 2; and Figures 1, 7, 8, and 9. 

Yet another aspect of the present invention, as claimed in independent claim 29, 
provides a method for analyzing a stream of network usage data (25) over a rolling time 
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interval. The method includes defining a statistical model (34, 130, 300) for analyzing the 
stream of network (28) usage data over the rolling time interval. The statistical model (34, 
130, 300) includes a histogram having a first axis (132, 302) illustrating total usage defined 
by a number of bins (136, 306), and a second axis (134, 304). Each bin has a usage variable 
range. The second axis is defined by a frequency corresponding to a number of users having 
a total usage within the usage variable range of each bin (136, 306). The method includes 
defining the rolling time interval to include a plurality of update time intervals; receiving a 
record event set from the stream of network (28) data for each update time interval (210), and 
storing the record event set (70) for each update interval (210) in a history cache (24). The 
method includes generating the statistical model (34) over the rolling time interval using each 
record event stored in the history cache (24) including generating an aggregation table (40, 
100) and updating the statistical model (34) using a most recent record event (52) for a most 
recent update time interval including updating only a portion of the aggregation table (40, 
100) associated with the most recent update time interval. See specification at page 10, line 
27 through page 11, line 12; page 14, line 18 through page 17, line 2; and Figures 1, 5, 7, 8, 
and 9 

Yet another aspect of the present invention, as claimed in independent claim 37, 
provides a network (28) usage analysis system (20) for analyzing a stream of network usage 
data (25). The system includes a data analysis system server (22) which generates a 
statistical model from a set of usage data record events, and upon receiving a most recent 
record event (52), the data analysis system server (22) updates the statistical model using the 
most recent record event (52) by adding the most recent record event (52) to the statistical 
model. An identifier is associated with each record event. The system includes updating 
only a portion of the statistical model associated with the identifier. See specification at page 
8, line 9 through 1 1, line 21; page 14, line 18 through page 15, line 10; and Figures 1, 7 and 
8. 

Yet another aspect of the present invention, as claimed in independent claim 45, 
provides a computer-readable medium having computer executable instructions for 
performing a method for analyzing a stream of network usage data. The method includes 
generating a statistical model (34, 130, 300) from a set of usage data record events (25), 
receiving a most recent record event (52), and updating the statistical model (34) using the 
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most recent record event (52) by adding the most recent record event (52) to the statistical 
model (34). An identifier is associated with each record event. The method includes 
updating only a portion of the statistical model (34, 130, 300) associated with the identifier. 
See specification at page 14 5 line 18 through page 15, line 10; and Figures 1, 2, 6, 7, 8 and 12 

Yet another aspect of the present invention, as claimed in independent claim 46, 
provides a method for analyzing a stream of network (28) usage data. The method includes 
generating a statistical model (34, 130, 300) from a set of network usage record events, 
receiving a most recent record event (52), and updating the statistical model (34, 130, 300) 
using the most recent record event (52) by adding the most recent record event (52) to the 
statistical model (34, 130, 300). The method includes storing the set of record events (70) in 
a history cache (24). If the history cache (24) is full, updating the statistical model (34, 130, 
300) includes removing a most recent record event (54) from the statistical model (34, 130, 
300). The method includes defining the statistical model (34, 130, 300) to include an 
aggregation of each record event set (70) stored in the history cache (24). An identifier is 
associated with each record event (72, 74, 76). Generating a statistical model (34, 130, 300) 
from the set of record events (70) includes generating an aggregation table (120) for tracking 
an aggregation of record events associated with an identifier. The most recent record event 
(52) is associated with an identifier. Updating the statistical model (34, 130, 300) includes 
updating only the aggregation of record events in the tracking table for that identifier. The 
method includes generating a histogram statistical model (34, 130, 300) from the aggregation 
table (100). The history cache (24) is an array of memory segments (206). The number of 
memory segments is equal to the number of update time intervals in the rolling time interval. 
The method includes storing each record event (72, 74, 76) in a memory segment in the 
history cache (24) and defining an index array associated with the statistical model including 
a set of contiguous index segments. Each index segment includes a pointer to the memory 
segment in the history cache (24) storing the next consecutive record event. The method 
includes defining a first pointer (226) to the index segment associated with the memory 
segment storing the most recent record event (218). Upon receiving a most recent record 
event (218) the method replacing the most recent record event (218) stored in the history 
cache (24) with the most recent record event (228), and further moving the first pointer (226) 
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to the next contiguous index segment. See specification at page 1 0, line 27 through page 1 1 , 
line 12; page 14, line 18 through page 20, line 6; and Figures 1, 2, and 4-15. 
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GROUNDS OF REJECTION TO BE REVIEWED ON APPEAL 



I. Whether claims 1, 2, 37, 38, and 45 are patentable under 35 U.S.C. §103(a) over 
Porras et al., U.S. Patent No. 6,321,338 ("Porras") in view of Fishman et al., U.S. 
Patent Application Publication 2001/0037321 ("Fishman"). 

IL Whether claim 13 is patentable under 35 U.S.C. §103(a) over Porras in view of 
Sarkissian et al., U.S. Patent No. 6,771,646 ("Sarkissian") and Fishman. 

III. Whether claim 23 is patentable under 35 U.S.C. §103(a) over Porras in view of 
Sarkissian and further in view of Kawasaki, U.S. Patent No. 6,539,375 ("Kawasaki") 
and Fishman. 

IV. Whether claims 29-36 are patentable under 35 U.S.C. § 1 03(a) over Porras in view of 
Sarkissian, Fishman, Costa, U.S. Patent No. 6,138,121 ("Costa"), and Aboulnaga, 
U.S. Patent No. 6,460,045 ("Aboulnaga"). 

V. Whether claims 3 and 39 are patentable under 35 U.S.C. §103(a) over Porras, and 
further in view of Steinbiss et al., U.S. Patent No. 6,823,307 ("Steinbiss"). 

VI. Whether claims 4 and 40 are patentable under 35 U.S.C. § 103(a) over Porras, 
Fishman, Steinbiss and further in view of Sarkissian. 

VII. Whether claims 5, 6, 8-10, 12, and 41-43 are patentable under 35 U.S.C. §103(a) over 
Porras, Fishman, Steinbiss, Sarkissian and further in view of Costa. 

VIII. Whether claims 7, 1 1, 14-22, 46 and 47 are patentable under 35 U.S.C. §103(a) over 
Porras, Fishman, Steinbiss, Sarkissian, Costa, and further in view of Aboulnaga. 

IX. Whether claims 8-10, 43, and 44 are patentable under 35 U.S.C. § 103(a) over Porras, 
Steinbiss, Sarkissian, Costa, and further in view of Fishman. 

X. Whether claim 24 is patentable under 35 U.S.C. § 1 03(a) over Porras, Sarkissian, 
Kawasaki, Fishman, and further in view of Steinbiss. 

. XL Whether claims 25 and 26 are patentable under 35 U.S.C. § 103(a) over Porras, 
Sarkissian, Kawasaki, Fishman, and further in view of Costa. 

XII. Whether claims 27 and 28 are patentable under 35 U.S.C. §103(a) over Porras, 
Sarkissian, Kawasaki, Fishman, Costa, and further in view of Aboulnaga. 
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ARGUMENT 



The rejection of claims 1-47 under 35 U.S.C. §103 

The claims do not stand together or fall together. Instead, Applicant presents separate 
arguments for various independent and dependent claims. Each of these arguments is 
separately presented below and presented with separate headings and sub-headings as 
required by 37 CFR § 41.37(c) (1) (vii) as follows: 

I. Claims 1, 2, 37, 38, and 45, with claims 1, 2, 37, 38, and 45 selected for 

discussion 

II. Claims 13-22, with claim 13 and 14 selected for discussion 

III. Claims 23-28, with claim 23 selected for discussion 

IV. Claims 29-36, with claim 29 selected for discussion 

V. Claims 3-4, 5-12, 39-40, and 41-44, with claims 3 and 39 selected for 
discussion 

VI. Claims 46-47, with claim 46 selected for discussion 

L Rejection of claims 1-2, 37-38, and 45 as being unpatentable under 35 U.S.C, 
§103(a) 

Claims 1, 2, 37-38, and 45 are rejected under 35 U.S.C. §103(a) as being unpatentable 
over Porras in view of Fishman. 
Applicable Law. 

Referring to 35 U.S.C. § 103(a), a patent may not be obtained though the invention is 
not identically disclosed or described as set forth in 35 U.S.C. § 102, if the differences 
between the subject matter sought to be patented and the prior art are such that the subject 
matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not 
be negated by the manner in which the invention was made. 

With regard to 35 U.S.C. § 103, "Patent examiners carry the responsibility of making 
sure that the standard of patentability enunciated by the Supreme Court and by the Congress 
is applied in each and every case ." M.P.E.P. 2141 (emphasis in the original). The Examiner 
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bears the burden under 35 U.S.C. § 103 in establishing a prima facie case of obviousness. In 
re Fine, 837 F.2d 1071, 1074, 5 USPQ2d 1596, 1598 (Fed. Cir. 1988). 

Three criteria must be satisfied to establish a prima facie case of obviousness. First, 
the Examiner must show that some objective teaching in the prior art or some knowledge 
generally available to one of ordinary skill in the art would teach, suggest, or motivate one to 
modify a reference or to combine the teachings of multiple references. In re Fine at 1074. 
Second, the prior art can be modified or combined only so long as there is a reasonable 
expectation of success. In re Merck & Co., Inc., 800 F.2d 1091, 231 USPQ 375, 379 (Fed. 
Cir. 1986). Third, the reference or combined references must teach or suggest all of the claim 
limitations. In re Royka, 490 F.2d 981, 180 USPQ 580 (C.C.P.A. 1974). 

The court in Fine stated: 

Obviousness is tested by "what the combined teaching of the references would 
have suggested to those of ordinary skill in the art." But it "cannot be 
established by combining the teachings of the prior art to produce the claimed 
invention, absent some teaching or suggestion supporting the combination." 
And "teachings of references can be combined only if there is some suggestion 
or incentive to do so." In re Fine, 5 USPQ2d at 1599 (citations omitted). 

There must be some teaching somewhere that provides the suggestion or motivation 
to combine prior art teachings and applies that combination to solve the same or similar 
problem that it addresses. In re Nilssen, 851 F.2d 1401, 1403, 7 USPQ2d 1500, 1502 (Fed. 
Cir. 1988); In re Wood, 599 F.2d 1032, 1037, 202 USPQ 171, 174 (C.C.P.A. 1979). In 
particular, "The teaching or suggestion to make the claimed combination and the reasonable 
expectation of success must both be found in the prior art, and not based upon Appellants' 
disclosure. In re Vaeck, 947 F.2d 488, 20 USPQ2d 1438 (Fed. Cir. 1991); M.P.E.P. § 2142 
(emphasis added). 

In order for prior art references to be properly applicable under 35 U.S.C. §103, there 
must be some teaching that the prior art attempts to solve the same or similar problem that the 
applicant's invention addresses. In re Nilssen, 851 F.2d 1401, 1403, 7 USPQ2d 1500, 1502 
(Fed. Cir. 1988); In re Wood, 599 F.2d 1032, 1037, 202 USPQ 171, 174 (CCPA 1979). In 
other words, a prima facie case of obviousness cannot be established if based upon a 
reference that is non- analogous art. In re Deminski, 796 F.2d 436, 442, 230 USPQ 313, 315 
(Fed. Cir. 1986); In re Clay, 966 F.2d 656, 658, 23 USPQ2d 1058, 1060-61 (Fed. Cir. 1992). 
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Two factors define whether a reference is analogous art: (1) whether the art is from the same 
field of endeavor, regardless of the problem addressed and, (2) if the reference is not within 
the field of the inventor's endeavor, whether the reference still is reasonably pertinent to the 
particular problem with which the inventor is involved. In re Deminski, 796 F.2d at 442, 230 
USPQat315. 

A reference is reasonably pertinent if ... it is one which, because of the matter 
with which it deals, logically would have commended itself to the inventor's 
attention in considering his problem ... If a reference disclosure has the same 
purpose as the claimed invention, the reference relates to the same problem . . . 
If is directed to a different purpose, the inventor would accordingly have had 
less motivation or occasion to consider it. 

In re Clay, 966 F.2d at 658, 23 USPQ2d at 1060-61. 

The test for obviousness under § 103 must take into consideration the invention as a 
whole; that is, one must consider the particular problem solved by the combination of 
elements that define the invention. Interconnect Planning Corp. v. Feil, 11 A F.2d 1 132, 
1 143, 227 USPQ 543, 551 (Fed. Cir. 1985). Furthermore, claims must be interpreted in light 
of the specification, claim language, other claims, and prosecution history. Panduit Corp. v. 
Dennison Mfg. Co., 810 F.2d 1561, 1568, 1 USPQ2d 1593, 1597 (Fed. Cir. 1987), cert 
denied, 481 U.S. 1052 (1987). At the same time, a prior patent cited as a § 103 reference 
must be considered in its entirety, "i.e. as a whole, including portions that lead away from the 
invention." Id. That is, the Examiner must recognize and consider not only the similarities, 
but also the critical differences between the claimed invention and the prior art as one of the 
factual inquiries pertinent to any obviousness inquiry under 35 U.S.C. § 103. In re Bond, 910 
F.2d 831, 834, 15 USPQ2d 1566, 1568 (Fed. Cir. 1990) (emphasis added). Finally, the 
Examiner must avoid hindsight. Id. 

With regard for the test for obviousness under § 103, a statement that modifications of 
the prior art to meet the claimed invention would have been " ' well within the ordinary skill 
of the art at the time the claimed invention was made' " because the references relied upon 
teach that all aspects of the claimed invention were individually known in the art is not 
sufficient to establish a prima facie case of obviousness without some objective reason to 
combine the teachings of the references. Ex parte Levengood, 28 USPQ2d 1300 (Bd. Pat. 
App. & Inter. 1993); M.P.E.P. § 2143.01 (emphasis in the original). 
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In conclusion, appellants are entitled to a patent grant if any one of the elements of a 
prima facie case of obviousness is not established. The Federal Circuit has endorsed this 
view in stating: "If examination at the initial stage does not produce a prima facie case of 
unpatentability, then without more the appellants are entitled to grant of the patent." In re 
Oetiker, 977 F.2d 1443, 1446, 24 USPQ2d 1443, 1448 (Fed. Cir. 1992). 

Independent claim 1 recites a method for analyzing a stream of network usage data. 
The method includes generating a statistical model from a set of usage data record events. 
The method includes updating a statistical model using the most recent record event by 
adding the most recent record event to the statistical model, wherein an identifier is 
associated with each record event, including updating only a portion of the statistical model 
associated with the identifier. 

Porras discloses a method of network surveillance including building at least one 
long-term and at least one short-term statistical profile of network packets that monitor data 
transfers, errors, or network connections. The long-term profile is compared to the short-term 
profile to determine whether suspicious network activity exists. (Col. 1, lines 44-54). 

Fishman recites a method of building predictive models based on transactional data. 
In the system of Fishman, sets of aggregation models are utilized, wherein each transactional 
source of data is processed by a dedicated aggregation module. When a new transactional 
record becomes available the output of the model is updated by processing the new records 
only associated with a dedicated aggregation module. The output of each aggregation 
module is an array of scalar numbers that can be used as an input to a traditional modeling 
module. (Paragraph 8). 

The Examiner admits that Porras fails to disclose updating only a portion of the 
statistical model associated with the identifier. The Examiner submits that this limitation is 
taught by Fishman. (Office Action mailed June 30, 2005, page 5). 

Fishman also does not teach or suggest updating only a portion of the statistical 
model associated with the identifier. In contrast, Fishman discloses updating the 
aggregation module outputs with each new transactional record. All aggregation module 
outputs combined with the traditional array of scalar inputs 26 are used as input attributes for 
the traditional modeling module 20 that implements logistic regression, neural networks, or 
radial basis functions technology. (See Fishman, paragraph 24). Accumulated values of f k l 
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are combined with the traditional array of scalar inputs S 322 and are used as input attributes 
for the traditional modeling module 324. Output of the model is calculated in the traditional 
modeling module 328. (Paragraphs 31 and 32). The new transactional record is processed 
412 and outputs of the corresponding aggregation module is updated 414. New values of f k ! 
are combined with the traditional array of scalar inputs S 4 1 6 and are used as input attributes 
for the traditional modeling module 418. These values may be stored again 420 for further 

* 

model output updates. Output of the model is calculated in the traditional modeling module 
422. (Paragraphs 39-4 1 ). 

Therefore, Fishman discloses updating the outputs of the aggregation module that 
provide the traditional array of scalar inputs to the traditional modeling module. In Fishman, 
the statistical model is not partially updated, but rather the entire statistical model is 
updated/recalculated based on a new set of scalar inputs provided by the aggregation module. 

Further, there is no teaching or suggestion to combine Porras and Fishman. There is 
no teaching in Porras or Fishman to combine the method of building predictive models on 
transactional data of Fishman with the network surveillance system of Porras. 

In view of the above, Porras and Fishman, either alone, or in combination, fail to 
teach or suggest the invention of independent claim 1. Accordingly, reversal of the rejection 
of claim 1 under 35 U.S.C. § 103(a) is respectfully requested. 

Dependent Claim 2 recites updating the statistical model further comprises 
removing a least recent record event from the statistical model. The Examiner submits 
that Porras explicitly shows these limitations in column 6, lines 47-50, which state that at 
update time (typically, a time of low system activity), the update function folds the short-term 
values observed since the last update into the long-term profile, and the short-term profile is 
cleared. This statement in Porras discloses clearing the entire short-term profile. In contrast, 
claims 2 recites removing a least recent record event from the statistical model In addition, 
claim 2 further defines patentably distinct claim 1 . 

In view of the above, claim 2 is also believed to be allowable over the cited 
references. Additionally, claim 2 further defines patentably distinct claim 1. Accordingly, 
reversal of the rejection of claim 2 under 35 U.S.C. §103(a) is respectfully requested. 

Independent claim 37 recites a network usage analysis system for analyzing a stream 
of network usage data. The network usage analysis system includes a data analysis system 
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server which upon receiving a most recent record event, the data analysis system server 
updates the statistical model using the most recent record event by adding the most recent 
record event to the statistical model, wherein an identifier is associated with each record 
event, including updating only a portion of the statistical model associated with the 
identifier. 

Independent claim 45 recites a computer readable medium having computer 
executable instructions for performing a method for analyzing a stream of network usage 
data. The method includes updating the statistical model using the most recent record event 
by adding the most recent record event to the statistical model, wherein an identifier is 
associated with each record event, including updating only a portion of the statistical 
model associated with the identifier. 

For the same reasons as discussed above with reference to claim 1 , Porras and 
Fishman, either alone, or in combination, fail to teach or suggest the invention of independent 
claims 37 and 45. Accordingly, reversal of the rejection of claims 37 and 45 under 35 U.S.C. 
§ 103(a) is respectfully requested. 

Dependent claim 38 recites wherein the data analysis system server removes the 
least recent record event from the statistical model. For the same reasons as discussed 
above with reference to claim 2, claim 38 is also believed to be allowable over the cited 
references. Reversal of the rejection of claim 38 under 35 U.S.C. §103(a) is respectfully 
requested. 

II. Rejection of claims 13-22 as being unpatentable under 35 U.S.C. §103(a) 

Claim 13 is rejected under 35 U.S.C. § 103(a) as being unpatentable over Porras, 
and further in view of Sarkissian and Fishman. Claim 14-22 are rejected under 35 U.S.C. § 
103(a) as being unpatentable over Porras, Fishman, Steinbiss, Sarkissian, Costa and further in 
view of Aboulnaga. 

Applicable Law. The applicable law is recited above in Section I. 

Independent claim 13 recites a method for analyzing a stream of network usage data 
over a rolling time interval. The method includes defining a statistical model for analyzing 
the stream of network usage data over the rolling time interval; defining the rolling time 
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interval to include a plurality of the time intervals; receiving a record event from the stream 
of data for each update time interval; storing the record event for each update interval in a 
history cache; generating the statistical model over the rolling time interval using the 
statistical model and each record event stored in the history cache; and updating the statistical 
model using the statistical model in a most recent record event for a most recent update time 
interval, including updating only a portion of tlie statistical model associated with the most 
recent record event. 

Sarkissian merely recites a cache structure for looking up one or more elements of an 
external memory. The cache structure is used for storing information associated with 
network packets. 

For the same reasons as discussed above with reference to claims 1, 37, and 45, 
Porras, Sarkissian, and Fishman, either alone, or in combination, fail to teach or suggest 
updating only a portion of the statistical model associated with the most recent record 
event. In addition, the Examiner appears to have failed to address the limitation storing the 
record event for each update interval in a history cache. 

In view of the above, Porras, Sarkissian, and Fishman, either alone, or in combination, 
fail to teach or suggest the invention of independent claim 1 3 . Accordingly, reversal of the 
rejection of claim 13 under 35 U.S.C. §103(a) is respectfully requested. 

Dependent claim 14-22 further define patentably distinct claim 13. Accordingly, 
dependent claim 14-22 are also believed to be allowable over the cited references. 

Further, dependent claim 14 recites wherein if the history cache is full, updating the 
statistical model further includes removing the least recent record event set associated with 
the least recent update time interval from the statistical model. The Examiner submits that 
Porras, Fishman, Steinbiss, Sarkissian, Costa and Aboulnaga discloses these limitations, in 
Steinbiss column 5, line 60 to column 6, line 7. (Office Action mailed June 30, 2005, page 
20). 

Steinbiss discloses a language model based on a speech recognition history. A small 
vocabulary pattern recognition system is used for recognizing a sequence of words, such as a 
sequence of digits or a sequence of commands. (See Abstract). Steinbiss does not update the 
statistical model. Steinbiss merely discloses a first in - first out, cache for a speech 
recognizer. (Column 5, line 61 -column 6, line 7). 
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In addition, Steinbiss is not analogous art. The speech recognition system is not 
analogous to a network data usage analysis system. One skilled in the art would not look to a 
vocabulary pattern recognition system when designing a network data usage analysis system. 
In addition, there is no teaching or suggestion to combine the network surveillance system or 
Porras, the method of building predictive models based on transactional data of Fishman, the 
vocabulary pattern recognition system of Steinbiss, the cache system of Sarkissian, the 
network management event storage system of Costa, and the self-tuning histogram and 
database modeling system of Aboulnaga in a manner to provide the invention recited by 
claim 14. 

III. Rejection of claim 23-28 as being unpatentable under 35 U.S.C. §103(a) 

Claim 23 is rejected under 35 U.S.C. § 103(a) as being unpatentable over Porras, 
Sarkissian, and further in view of Kawasaki, and Fishman. Claim 24 is rejected under 35 
U.S.C. § 103(a) as being unpatentable over Porras, Sarkissian, Kawasaki, Fishman, and 
further in view of Steinbiss. Claim 25-26 are rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Porras, Sarkissian, Kawasaki, Fishman, and further in view of Costa. 
Claim 27-28 are rejected under 35 U.S.C. § 103(a) as being unpatentable over Porras, 
Sarkissian, Kawasaki, Costa and further in view of Aboulnaga. 

Applicable Law. The applicable law is recited above in Section I. 

Independent claim 23 recites a method for analyzing a stream of network usage data 
over a rolling time interval. The method includes updating only a portion of the statistical 
model associated with the most recent record event for a most recent update time interval. 

Kawasaki discloses a method and system for generating and using a computer user's 

personal interest profile. 

For the same reasons as discussed above with reference to claims 1, 37, and 45, 
Porras, Sarkissian, Kawasaki, and Fishman, either alone, or in combination, fail to teach or 
suggest updating only a portion of the statistical model associated with the most recent 
record event for a most recent update time interval. 

In addition, there is no teaching or suggestion to combine the method of generating 
and using a computer user's personal interest profile of Kawasaki with the network 
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surveillance system of Porras, the cache system of Sarkissian, and the method of building 
predictive models based on transactional data of Fishman. 

In view of the above, Porras, Sarkissian, Kawasaki, and Fishman, either alone, or in 
combination, fail to teach or suggest the invention of independent claim 23. Accordingly, 
reversal of the rejection of claim 23 under 35 U.S.C. § 103(a) is respectfully requested. 

Dependent claim 24-28 further define patentably distinct claim 23. Accordingly, 
dependent claims 24-28 are also believed to be allowable over the cited references. 

IV. Rejection of claims 29-36 as being unpatentable under 35 U.S.C. §103(a) 

Claims 29-36 are rejected under 35 U.S.C. § 103(a) as being unpatentable 
over Porras, Sarkissian, Fishman, Costa, and further in view of Aboulnaga. 

Applicable Law. The applicable law is recited above in Section I. 

Independent claim 29 recites a method for analyzing a stream of network usage data 
over a rolling time interval. The method includes defining a statistical model for analyzing 
the stream of network usage data over the rolling time interval, the statistical model including 
a histogram having a first axis illustrating total usage defined by a number of bins, each bin 
having a usage variable range, and a second axis defined by a frequency corresponding to a 
number of users having a total usage within the usage variable range of each bin; defining the 
rolling time interval to include a plurality of update time intervals; receiving a record event 
set from the stream of network data for each update time interval; storing the record event set 
for each update interval in a history cache; generating the statistical model over the rolling 
time interval using each record event stored in the history cache including generating an 
aggregation table; and updating the statistical model using a most recent record event for a 
most recent update time interval including updating only a portion of the aggregation table 
associated with the most recent update time interval. 

Costa merely discloses the use of an aggregation table in tracking network status 

events. 

Aboulnaga discloses building histograms by using feedback information about the 
execution of query workload rather than by examining the data to help reduce the cost of 
building and maintaining histograms. 
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Porras, Sarkissian, Fishman, Costa, and Aboulnaga, either alone, or in combination, 
fail to teach or suggest defining a statistical model for analyzing the stream of network 
usage data over the rolling time interval, the statistical model including a histogram 
having a first axis illustrating total usage defined by a number of bins, each bin having a 
usage variable range, and a second axis defined by a frequency corresponding to a 
number of users having a total usage within the usage variable range of each bin. 
Further, none of the cited references, either alone or in combination, teach or suggest 
generating the statistical model over the rolling time interval using each record event 
stored in the history cache including generating an aggregation table; and updating the 
statistical model using a most recent record event for a most recent update time interval 
including updating only a portion of the aggregation table associated with the most 
recent update time interval. 

In addition, there is no teaching or suggestion to combine the network management 
event storage system of Costa with the self-tuning histograms of Aboulnaga, the network 
surveillance system of Porras, the cache system of Sarkissian, and the method of building 
predictive models based on transactional data of Fishman. One skilled in the art could not 
combine these references in a manner to provide the invention recited by claim 29. 

In view of the above, independent claim 29 is not taught or suggested by the cited 
references. Therefore, reversal of the rejection of claim 29 under 35 U.S.C. § 103(a) is 
respectfully requested. 

Dependent claims 30-36 further define patentably distinct claim 29. Accordingly, 
dependent claims 30-36 are also believed to be allowable over the cited references. 

Further, Porras, Sarkissian, Fishman, Costa, and Aboulnaga, either alone, or in 
combination, fail to teach or suggest updating the statistical model further includes removing 
a least recent record event set associated with a least recent update time interval from the 
statistical model (claim 30), defining the statistical model to include an aggregation of each 
record event stored in the history cache (claim 31), wherein the history cache is an array of 
memory segments, wherein the number of memory segments is equal to the number of update 
time intervals in the rolling time interval (claim 32), storing each record event. in a memory 
segment in the history cache (claim 33), defining an index array associated including a set of 
contiguous index segments wherein each index segment including a pointer to the memory 
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segment storing in the history cache storing the next consecutive record event (claim 34), 
defining a first pointer to the index segment associated with the memory segment storing the 
least recent record event (claim 35), and generating the histogram statistical model from the 
aggregation table; and updating only a portion of the histogram statistical model associated 
with the most recent record event set (claim 36). 

V. Rejection of claims 3-12, and 39-44 as being unpatentable under 35 U.S.C. 
§103(a) 

Claims 3 and 39 are rejected under 35 U.S.C. §103(a) as being unpatentable over 
Porras and further in view of Steinbiss. Claims 4 and 40 are rejected under 35 U.S.C. 
§ 103(a) as being unpatentable over Porras, Fishman, Steinbiss, and further in view of 
Sarkissian. 

Claims 5-6, 8-10, 12, and 41-44 are rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Porras, Fishman, Steinbiss, Sarkissian and further in view of Costa. 
Claims 7, 1 1 are rejected under 35 U.S.C. §103(a) as being unpatentable over Porras, 
Fishman, Steinbiss, Sarkissian, Costa and further in view of Aboulnaga. 

Applicable Law. The applicable law is recited above in Section I. 

The Examiner admits Porras and Fishman fail to disclose storing the set of records in 
a history cache and wherein if the history cache is full updating the statistical model includes 
removing a least recent record event from the statistical model. The Examiner submits these 
limitations are taught by Steinbiss (Office Action mailed June 6, 2005, page 16). 

Steinbiss also fails to teach or suggest further comprising the steps of storing the 
set of record events in a history cache, and wherein if the history cache is full, updating 
the statistical model includes removing a least recent record event from the statistical 
model (claim 3) and defining a least recent record event; and wherein the data analysis 
system server removes the least recent record event from the statistical model (Claim 
39). 

Steinbiss discloses a language model based on a speech recognition history. A small 
vocabulary pattern recognition system is used for recognizing a sequence of words, such as a 
sequence of digits or a sequence of commands. (See Abstract). Steinbiss does not update the 
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statistical model. Steinbiss merely discloses a first in-first out cache for a speech recognizer. 
(Col. 5, line 61 - col. 6, line 7). 

In addition, Steinbiss is not analogous art. A speech recognition system is not 
analogous to a network data usage analysis system. One skilled in the art would not look to a 
vocabulary pattern recognition system when designing a network data usage analysis system. 
In addition, there is no teaching or suggestion to combine the network surveillance system of 
Porras, the method of building predictive models based on transactional data of Fishman, and 
the vocabulary pattern recognition system of Steinbiss in a manner to provide the invention 
recited by claims 3 and 39. Further, claim 3 further defines patentably distinct claim 1, and 
claim 39 further defines patentably distinct claim 37. Accordingly, dependent claims 3 and 
39 are also believed to be allowable over the cited references. 

Claims 4-12 further define patentably distinct claim 3, and dependent claims 40-44 
further define patentably distinct claim 39. Accordingly, dependent claims 4-12 and 40-44 
are also believed to be allowable over the cited references. 

VI. Rejection of claims 46-47 as being unpatentable under 35 U.S.C. §103(a) 

Claims 46-47 are rejected under 35 U.S.C. § 103(a) as being unpatentable over 
Porras, Fishman, Steinbiss, Sarkissian, Costa and further in view of Aboulnaga. 

Applicable Law. The applicable law is recited above in Section I. 

Independent claim 46 recites a method for analyzing a stream of network usage data. 
The method includes generating a statistical model from a set of network usage record events; 
receiving a most recent record event; and updating the statistical model using the most recent 
record event by adding the most recent record event to the statistical model further 
comprising the steps of: storing the set of record events in a history cache; wherein if the 
history cache is full, updating the statistical model includes removing a least recent record 
event from the statistical model, further comprising: defining the statistical model to include 
an aggregation of each record event set stored in the history cache, wherein an identifier is 
associated with each record event, and wherein generating a statistical model from the set of 
record events includes generating an aggregation table for tracking an aggregation of record 
events associated with an identifier, wherein the most recent record event is associated with 
an identifier; and wherein updating the statistical model includes updating only the 
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aggregation of record events in the tracking table for that identifier, further comprising 
generating a histogram statistical model from the aggregation table, wherein the history cache 
is an array of memory segments, wherein the number of memory segments is equal to the 
number of update time intervals in the rolling time interval, and storing each record event in a 
memory segment in the history cache, and defining an index array associated with the 
statistical model including a set of contiguous index segments, wherein each index segment 
includes a pointer to the memory segment in the history cache storing the next consecutive 
record event, further defining a first pointer to the index segment associated with the memory 
segment storing the least recent record event, wherein upon receiving a most recent record 
event the method replacing the least recent record event stored in the history cache with the 
most recent record event, and further moving the first pointer to the next contiguous index 
segment. 

For the same reasons as discussed above with reference to the above claims, 
independent claim 46 is not taught or suggested by Porras, Fishman, Steinbiss, Sarkissian, 
Costa, and Aboulnaga, either alone, or in combination. Additionally, Steinbiss is not an 
analogous art. There is no teaching or suggestion to combine the network surveillance 
system or Porras, the method of building predictive models based on transactional data of 
Fishman, the vocabulary pattern recognition system of Steinbiss, the cache system of 
Sarkissian, the network management event storage system of Costa, and the self-tuning 
histogram and database modeling system of Aboulnaga in a manner to provide the invention 
recited by claim 46. In view of the above and the arguments presented under claim 14, 
withdrawal of the rejection of claim 46 under 35 U.S.C. §103(a) is respectfully requested. 

Dependent claim 47 further defines patentably distinct claim 46. Accordingly, 
dependent claim 47 is also believed to be allowable over the cited references. 
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CONCLUSION 

The claims of the pending application stand twice rejected. Independent claims 1,13, 
23, 29, 37, and 45 were amended in a Response mailed March 7, 2005 to recite limitations 
that are not taught or suggested by the cited references. In addition, independent claim 46 
was added in the Response mailed March 7, 2005 to recite limitations that are not taught or 
suggested by the cited references. 

For the above reasons, Appellant respectfully submits that the cited references do not 
render obvious claims of the pending invention. The pending claims distinguish over the 
cited references, and therefore, Appellant respectfully submits that the rejections must be 
withdrawn, and respectfully request the Examiner be reversed and claims 1-47 be allowed. 
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Any inquiry regarding this Appeal Brief should be directed to either Phil Lyren at 
Telephone No. (281) 514-8236, Facsimile No. (281) 514-8332 or Steven E. Dicke at 
Telephone No. (612) 573-2002, Facsimile No. (612) 573-2005. In addition, all 
correspondence should continue to be directed to the following address: 

Hewlett-Packard Company 

Intellectual Property Administration 
P.O. Box 272400 

Fort Collins, Colorado 80527-2400 



CERTIFICATE UNDER 37 C.F.R. 1.8 : 

The undersigned hereby certifies that this paper or papers, as described herein, are being deposited in the United 
States Postal Service, as first class mail, in an envelope address to: Mail Stop Appeal Brief - Patents, Commissioner 
for Patents, P.O. Box 1450, Alexandria, VA 22313-1450 on this "2- day of January, 2006 . 
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N. Lee Rhodes, 



By his attorneys, 



DICKE, BILLIG & CZAJA, PLLC 
Fifth Street Towers, Suite 2250 
100 South Fifth Street 
Minneapolis, MN 55402 
Telephone: (612) 573-2002 
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CLAIMS APPENDIX 

1 . (Previously Presented) A method for analyzing a stream of network usage data 
comprising: 

generating a statistical model from a set of usage data record events; 
receiving a most recent record event; and 

updating the statistical model using the most recent record event by adding the most 
recent record event to the statistical model, wherein an identifier is associated with each 
record event, including updating only a portion of the statistical model associated with the 
identifier. 

2. (Original) The method of claim 1, wherein updating the statistical model further 
comprises removing a most recent record event from the statistical model. 

3. (Original) The method of claim 1, further comprising the steps of storing the set of 
record events in a history cache, and wherein if the history cache is full, updating the 
statistical model includes removing a least recent record event from the statistical model. 

4. (Original) The method of claim 3, further comprising defining the statistical model to 
include an aggregation of each record event set stored in the history cache. 

5. (Previously Presented) The method of claim 4, wherein generating a statistical model 
from the set of record events includes generating an aggregation table for tracking an 
aggregation of record events associated with an identifier. 

6. (Original) The method of claim 5, comprising generating a complex statistical model 
representative of the network data from the aggregation table. 

7. (Original) The method of claim 5, comprising generating a histogram statistical 
model (130) representative of the network data from the aggregation table. 
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8. (Original) The method of claim 5, wherein the most recent record event is associated 
with an identifier; and wherein updating the statistical model includes updating only the 
aggregation of record events in the tracking table for that identifier. 

9. (Original) The method of claim 8, further comprising generating a complex statistical 
model from the aggregation table. 

10. (Original) The method of claim 9, further wherein updating the statistical model 
includes updating only a portion of the complex statistical model associated with an 
identifier. 

1 1 . (Original) The method of claim 8, further comprising generating a histogram 
statistical model from the aggregation table. 

12. (Original) The method of claim 5, wherein upon receiving a most recent record event 
the method further comprising replacing the least recent record event stored in the history 
cache with the most recent record event. 

13. (Previously Presented) A method for analyzing a stream of network usage data over a 
rolling time interval comprising: 

defining a statistical model for analyzing the stream of network usage data over the 
rolling time interval; 

defining the rolling time interval to include a plurality of update time intervals; 

receiving a record event from the stream of data for each update time interval; 

storing the record event for each update interval in a history cache; 

generating the statistical model over the rolling time interval using the statistical 
model and each record event stored in the history cache; and 

updating the statistical model using the statistical model and a most recent record 
event for a most recent update time interval, including updating only a portion of the 
statistical model associated with the most recent record event. 
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14. (Original) The method of claim 11, wherein if the history cache is full, updating the 
statistical model further includes removing a least recent record event set associated with a 
least recent update time interval from the statistical model. 

15. (Original) The method of claim 11, further comprising defining the statistical model 
to include an aggregation of each record event set stored in the history cache. 

16. (Original) The method of claim 1 1, wherein the history cache is an array of memory 
segments, wherein the number of memory segments is equal to the number of update time 
intervals in the rolling time interval. 

17. (Original) The method of claim 16, further comprising storing each record event in a 
memory segment in the history cache. 

18. (Original) The method of claim 17, further comprising defining an index array 
associated including a set of contiguous index segments, wherein each index segment 
including a pointer to the memory segment storing in the history cache storing the next 
consecutive record event. 

19. (Original) The method of claim 1 8, further defining a first pointer to the index 
segment associated with the memory segment storing the least recent record event. 

20. (Original) The method of claim 19, wherein upon receiving a most recent record 
event the method further comprising replacing the least recent record event stored in the 
history cache with the most recent record event. 

21 . (Original) The method of claim 20, further comprising moving the first pointer to the 
next contiguous index segment. 

22. (Original) The method of claim 19, further defining a second pointer to the index 
segment associated with the memory segment storing the most recent record event. 
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23. (Previously Presented) A method for analyzing a stream of network usage data over a 
rolling time interval comprising: 

defining a statistical model for analyzing the stream of network usage data over the 

rolling time interval; 

defining the rolling time interval to include a plurality of update time intervals; 

receiving a record event set from the stream of data for each update time interval, 
each record event set including one or more record events, wherein each record event is 
associated with a user identifier; 

storing the record event set for each update interval in a history cache; 

generating the statistical model over the rolling time interval using each record event 
stored in the history cache; and 

updating only a portion of the statistical model associated with the most recent record 
event for a most recent update time interval. 

24. (Previously Presented) The method of claim 23, wherein if the history cache is full, 
updating the statistical model further includes removing a least recent record event set 
associated with a least recent update time interval from the statistical model. 

25. (Previously Presented) The method of claim 23, further comprising defining the 
statistical model to include an aggregation table having an aggregation table entry for 
tracking an aggregation of each record event set stored in the history cache for each user 
identifier. 

26. (Previously Presented) The method of claim 25, wherein the step of updating the 
statistical model includes the step of updating only the aggregation table entry associated 
with the most recent record event. 

27. (Original) The method of claim 26, further comprising generating a histogram from 
the aggregation table. 
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28. (Original) The method of claim 27, further wherein updating the statistical result 
includes updating only the portion of the histogram associated with the aggregation table 
entry associated with the most recent record event. 

29. (Previously Presented) A method for analyzing a stream of network usage data over a 
rolling time interval comprising: 

defining a statistical model for analyzing the stream of network usage data over the 
rolling time interval, the statistical model including a histogram having a first axis illustrating 
total usage defined by a number of bins, each bin having a usage variable range, and a second 
axis defined by a frequency corresponding to a number of users having a total usage within 
the usage variable range of each bin; 

defining the rolling time interval to include a plurality of update time intervals; 

receiving a record event set from the stream of network data for each update time 
interval; 

storing the record event set for each update interval in a history cache; 

generating the statistical model over the rolling time interval using each record event 
stored in the history cache including generating an aggregation table; and 

updating the statistical model using a most recent record event for a most recent 
update time interval including updating only a portion of the aggregation table associated 
with the most recent update time interval. 

30. (Original) The method of claim 29, wherein if the history cache is full, updating the 
statistical model further includes removing a least recent record event set associated with a 
least recent update time interval from the statistical model. 

3 1 . (Original) The method of claim 29, further comprising defining the statistical model 
to include an aggregation of each record event set stored in the history cache. 

32. (Original) The method of claim 29, wherein the history cache is an array of memory 
segments, wherein the number of memory segments is equal to the number of update time 
intervals in the rolling time interval. 
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33. (Original) The method of claim 32, further comprising storing each record event in a 
memory segment in the history cache. 

34. (Original) The method of claim 29, further comprising defining an index array 
associated including a set of contiguous index segments, wherein each index segment 
including a pointer to the memory segment storing in the history cache storing the next 
consecutive record event. 

35. (Original) The method of claim 34, further defining a first pointer to the index 
segment associated with the memory segment storing the least recent record event. 

36. (Previously Presented) The method of claim 29, further comprising generating the 
histogram statistical model from the aggregation table; and updating only a portion of the 
histogram statistical model associated with most recent record event set. 

37. (Previously Presented) A network usage analysis system for analyzing a stream of 
network usage data comprising: 

a data analysis system server which generates a statistical model from a set of usage 
data record events, and upon receiving a most recent record event, the data analysis system 
server updates the statistical model using the most recent record event by adding the most 
recent record event to the statistical model, wherein an identifier is associated with each 
record event, including updating only a portion of the statistical model associated with the 
identifier. 

38. (Original) The system of claim 37, further comprising: 

defining a least recent record event; and wherein the data analysis system server 
removes a least recent record event from the statistical model. 

39. (Original) The system of claim 37, further comprising: 
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defining a history cache, wherein the data analysis system server stores the set of 
record events in the history cache, and wherein if the history cache is full, updating the 
statistical model includes removing a least recent record event from the statistical model. 

40. (Original) The system of claim 39, further comprising: 

defines the statistical model to include an aggregation of each record event set stored 
in the history cache. 

41 . (Original) The system of claim 40, wherein an identifier is associated with each 
record event, and wherein generating a statistical model from the set of record events 
includes the data analysis system server generating an aggregation table for tracking an 
aggregation of record events associated with an identifier. 

42. (Original) The system of claim 41, wherein the data analysis system server generates 
a complex statistical model representative of the network data from the aggregation table. 

43. (Original) The system of claim 41, wherein the most recent record event is associated 
with an identifier; and wherein the data analysis system server updating the statistical model 
includes updating only the aggregation of record events in the tracking table for that 
identifier. 

44. (Original) The system of claim 43, further wherein the data analysis system server 
generates a complex statistical model from the aggregation table. 

45. (Previously Presented) A computer-readable medium having computer executable 
instructions for performing a method for analyzing a stream of network usage data, the 
method comprising: 

generating a statistical model from a set of usage data record events; 
receiving a most recent record event; and 

updating the statistical model using the most recent record event by adding the most 
recent record event to the statistical model, wherein an identifier is associated with each 
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record event, including updating only a portion of the statistical model associated with the 
identifier. 

46. (Previously Presented) A method for analyzing a stream of network usage data 
comprising: 

generating a statistical model from a set of network usage record events; 

receiving a most recent record event; and 
updating the statistical model using the most recent record event by adding the most recent 
record event to the statistical model further comprising the steps of: 

storing the set of record events in a history cache; 

wherein if the history cache is full, updating the statistical model includes 
removing a least recent record event from the statistical model, further comprising: 

defining the statistical model to include an aggregation of each record 
event set stored in the history cache, wherein an identifier is associated with each record 
event, and wherein generating a statistical model from the set of record events includes 
generating an aggregation table for tracking an aggregation of record events associated with 
an identifier, wherein the most recent record event is associated with an identifier; and 

wherein updating the statistical model includes updating only the aggregation 
of record events in the tracking table for that identifier, further comprising generating a 
histogram statistical model from the aggregation table, wherein the history cache is an array 
of memory segments, wherein the number of memory segments is equal to the number of 
update time intervals in the rolling time interval, and storing each record event in a memory 
segment in the history cache, and defining an index array associated with the statistical model 
including a set of contiguous index segments, wherein each index segment includes a pointer 
to the memory segment in the history cache storing the next consecutive record event, further 
defining a first pointer to the index segment associated with the memory segment storing the 
least recent record event, wherein upon receiving a most recent record event the method 
replacing the least recent record event stored in the history cache with the most recent record 
event, and further moving the first pointer to the next contiguous index segment. 
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47. (Previously Presented) The method of claim 46, wherein the histogram statistical 
model includes a first statistical model including a histogram having a first axis illustrating 
total usage defined by a number of bins, each bin having a usage variable range, and a second 
axis defined by a frequency corresponding to a number of users having a total usage within 
the usage variable range of each bin. 



32 



Appeal Brief to the Board of Patent Appeals and Interferences 

Applicant: N. Lee Rhodes 
Serial No.: 09/919,527 
Filed: July 31, 2001 
Docket No.: 10013111-1 

Title: NETWORK USAGE ANALYSIS SYSTEM AND METHOD FOR UPDATING STATISTICAL 
MODELS 



EVIDENCE APPENDIX 

None. 



33 



Appeal Brief to the Board of Patent Appeals and Interferences 

Applicant: N. Lee Rhodes 
Serial No.: 09/919,527 
Filed: July 31, 2001 
Docket No.: 10013111-1 

Title: NETWORK USAGE ANALYSIS SYSTEM AND METHOD FOR UPDATING STATISTICAL 
MODELS 



RELATED PROCEEDINGS APPENDIX 

None. 



34 



